2 issues skipped by the security teams:
- CVE-2016-4570: The mxmlDelete function in mxml-node.c in mxml 2.9, 2.7, and possibly earlier allows remote attackers to cause a denial of service (stack consumption) via crafted xml file.
- CVE-2016-4571: The mxml_write_node function in mxml-file.c in mxml 2.9, 2.7, and possibly earlier allows remote attackers to cause a denial of service (stack consumption) via crafted xml file.
![[bug history graph]](https://qa.debian.org/data/bts/graphs/m/mxml.png){kind=link}